YITH WooCommerce Ajax Product Filter Security & Risk Analysis

The YITH WooCommerce Ajax Navigation plugin version 5.18.0 exhibits a mixed security posture. While it demonstrates good practices in areas like SQL prepared statements (94%) and output escaping (92%), and has no currently unpatched vulnerabilities, several concerning aspects require attention. The presence of two AJAX handlers without authentication checks represents a significant attack vector, as does the higher-than-expected number of taint flows with unsanitized paths (8 out of 19 analyzed), including five rated as high severity. This indicates potential vulnerabilities in how user input is handled, which could lead to security issues if not properly addressed.

The plugin's vulnerability history, with three known CVEs including one high severity and two medium severity, points to recurring security weaknesses. The common types of past vulnerabilities being Cross-site Scripting and Missing Authorization further align with the findings in the static analysis, particularly the unprotected AJAX endpoints. The most recent vulnerability being July 10, 2024, suggests that while vulnerabilities are being addressed, the potential for them to re-emerge or new ones to be introduced remains. Overall, while the plugin has strengths in its handling of SQL and output, the unprotected entry points and high number of unsanitized taint flows are critical areas of concern that need immediate mitigation.